CVE-2026-72732

Received Received - Intake

Information Disclosure in Discourse via Unfiltered Tags

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72732

EUVD

EUVD-2026-55678

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	to 2026.1.6 (exc)
discourse	discourse	to 2026.5.2 (exc)
discourse	discourse	to 2026.6.1 (exc)
discourse	discourse	to 2026.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Discourse, a discussion platform, involves the discourse_templates endpoint exposing hidden tag names due to improper filtering by DiscourseTemplates::TemplatesSerializer. The serializer did not enforce tag group permissions, allowing unauthorized users to view tags they should not have access to.

Detection Guidance

This vulnerability can be detected by checking Discourse versions and inspecting the discourse_templates endpoint for exposed hidden tags. Use commands like curl to query the endpoint and verify if unauthorized tags are visible. Ensure your Discourse instance is updated to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 or later.

Impact Analysis

If exploited, this vulnerability could allow users to see restricted tags, potentially exposing sensitive or confidential information. This may lead to unauthorized access to discussions or data they are not permitted to view.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by exposing sensitive data to unauthorized users. It may result in data breaches, leading to legal penalties or reputational damage.

Mitigation Strategies

Upgrade Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 or later to fix the issue where hidden tag names were exposed due to improper tag filtering in the discourse_templates endpoint.

Hi! I’m here to help you understand CVE-2026-72732. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70